Support for data:image

Everything about using Adblock Plus on Mozilla Firefox, Thunderbird and SeaMonkey
Michael
Posts: 1361
Joined: Sat Dec 19, 2009 12:29 pm

Support for data:image

Post by Michael »

Would it please be possible for Adblock Plus to somehow support data:image? It has been noticed that adverts are being provided in this form on a familiar website (see the private forum for details) and it would be preferable to close this loophole as soon as possible.

Furthermore, I would also request that the context menu entry is corrected when right clicking on such images, as it usually, yet incorrectly, provides the option to block the background image as opposed to the one loaded from data:image.
Radik245
Posts: 7
Joined: Fri Nov 26, 2010 12:02 am
Contact:

Re: Support for data:image

Post by Radik245 »

I do not understand how "on a familiar website" image done, but for example, Google News image encoded in Base64 and can not be blocked because they are part of the source code of the page.
p2u
Posts: 39
Joined: Fri Feb 20, 2009 10:43 am

Re: Support for data:image

Post by p2u »

Radik245 wrote:Google News image encoded in Base64 and can not be blocked because they are part of the source code of the page.
You *can* block them easily (I do!), but you have to edit an ABP parameter in about:config
See here. It's important to RESTART the browser for the change to take effect.

Paul
Radik245
Posts: 7
Joined: Fri Nov 26, 2010 12:02 am
Contact:

Re: Support for data:image

Post by Radik245 »

Paul, what this block is better than hiding?
Upd.:
What you suggested, helps and "on a familiar website". Maybe it really is better to remove the artificial restriction? Not all users know how to make rules to hide.
p2u
Posts: 39
Joined: Fri Feb 20, 2009 10:43 am

Re: Support for data:image

Post by p2u »

Radik245 wrote:Paul, what this block is better than hiding?
Not for the ones who want to pay for maintaining their sites through advertising, of course.
P.S.: I just gave you an explanation of how this works. The problem for the client is that if you just "hide" content, it is still downloaded, NOT blocked, and *may* harm your system. Personally, I use ABP as a security add-on, and with a Default Deny stance you *have to* include data into the blockable items. The problem is that security solutions have a hard time filtering data URI schemes. Now suppose this gets exploited, just like shortened urls etc...

Paul
Radik245
Posts: 7
Joined: Fri Nov 26, 2010 12:02 am
Contact:

Re: Support for data:image

Post by Radik245 »

Really for "blocking" data:image images are not downloaded? Have a look at the page source code. Even "address"of the image to be used when blocking, is the very image.
p2u
Posts: 39
Joined: Fri Feb 20, 2009 10:43 am

Re: Support for data:image

Post by p2u »

Radik245 wrote:Really for "blocking" data:image images are not downloaded? Have a look at the page source code. Even "address"of the image to be used when blocking, is the very image.
It's all blocked all right. You can check it with HttpFox.
By default I get the Russian version of Google News, but the output in HttpFox for the forced English (US) version is:
http://news.google.com/news?cf=all&ned= ... =lbe_ru_ru

Code: Select all

00:00:01.812	0.147	441	300	GET	200	text/html	http://news.google.com/news?cf=all&ned=us&edchanged=1&ict=lbe_ru_ru
00:00:02.184	0.131	389	4944	GET	200	image/jpeg	http://i.ytimg.com/vi/FspuDPWpdx0/default.jpg
00:00:02.190	0.128	389	4998	GET	200	image/jpeg	http://i.ytimg.com/vi/1_Nanoe9zfI/default.jpg
00:00:02.195	0.134	389	5005	GET	200	image/jpeg	http://i.ytimg.com/vi/jJNYQFolIEk/default.jpg
00:00:02.201	0.131	389	4105	GET	200	image/jpeg	http://i.ytimg.com/vi/ZhnsMcUYtu8/default.jpg
00:00:02.206	0.158	389	4947	GET	200	image/jpeg	http://i.ytimg.com/vi/RwZPM5GsjLU/default.jpg
As you can see, only i.ytimg.com gets through because it's whitelisted to see images on YouTube.
Added screenshot: imagepost.ru/images/697/data.jpg (red items blocked, green ones allowed)

Paul
User avatar
Adblock Plus Fan
Posts: 1255
Joined: Sat Feb 24, 2007 11:08 am

Re: Support for data:image

Post by Adblock Plus Fan »

@p2u

I think you have been mislead. Depending on the implementation it can be blocked by ABP, but most of the time it's useless, whether the image is displayed or not is just a formality.

For example:
dict.leo.org, the data image is loaded from stylesheet file. You could block them from ABP by blocking http://dict.leo.org/css/top.b64-B1FoY2.css .
But for google news, you need to block the html, and ABP can't do this, you would need Blocksite or the Redirector extension.
p2u
Posts: 39
Joined: Fri Feb 20, 2009 10:43 am

Re: Support for data:image

Post by p2u »

Adblock Plus Fan wrote:@p2u

I think you have been mislead. Depending on the implementation it can be blocked by ABP, but most of the time it's useless, whether the image is displayed or not is just a formality.
I see. Even if I allow everything, there's no difference in HttpFox's output. I just see the images displayed.
Adblock Plus Fan wrote:But for google news, you need to block the html, and ABP can't do this, you would need Blocksite or the Redirector extension.
As a matter of fact, I have a lot of Google blocking in place through the hosts file. I'll have a closer look into this. Thanks.

Paul
User avatar
Adblock Plus Fan
Posts: 1255
Joined: Sat Feb 24, 2007 11:08 am

Re: Support for data:image

Post by Adblock Plus Fan »

The positive thing about base 64 encoded images is that there are no privacy issues in any of these examples, they can all be considered as good as 1st party.
vasa1
Posts: 76
Joined: Wed Apr 14, 2010 8:59 am

Re: Support for data:image

Post by vasa1 »

Adblock Plus Fan wrote:The positive thing about base 64 encoded images is that there are no privacy issues in any of these examples, they can all be considered as good as 1st party.
I read somewhere that there can be security issues. If I dig up the link, I'll post it here.
vasa1
Posts: 76
Joined: Wed Apr 14, 2010 8:59 am

Re: Support for data:image

Post by vasa1 »

p2u wrote:
Radik245 wrote:Google News image encoded in Base64 and can not be blocked because they are part of the source code of the page.
You *can* block them easily (I do!), but you have to edit an ABP parameter in about:config
See here. It's important to RESTART the browser for the change to take effect.

Paul
I think we should differentiate blocking of download and blocking of display after content has been downloaded. I think this forum prefers "hiding" for the latter.

Hiding images which originate from data URIs in Google News can be done with the Element Hiding Helper using this code:

Code: Select all

news.google.com##IMG[class]
(posted elsewhere).
vasa1
Posts: 76
Joined: Wed Apr 14, 2010 8:59 am

Re: Support for data:image

Post by vasa1 »

vasa1 wrote:
Adblock Plus Fan wrote:The positive thing about base 64 encoded images is that there are no privacy issues in any of these examples, they can all be considered as good as 1st party.
I read somewhere that there can be security issues. If I dig up the link, I'll post it here.
I don't mean to be facetious but in this case, a Google search (security +data +URI +URL) and Wikipedia throw up some possibilities.
p2u
Posts: 39
Joined: Fri Feb 20, 2009 10:43 am

Re: Support for data:image

Post by p2u »

Adblock Plus Fan wrote:I think you have been mislead. Depending on the implementation it can be blocked by ABP, but most of the time it's useless, whether the image is displayed or not is just a formality.
I took the challenge and did a test with CacheViewer (Firefox extension) on the above mentioned Google page. I even made it my home page so that nothing would interfere. I'm constantly in "Private Mode", so nothing gets written to disk.

Here's the output when my block rule is in place:
imagepost.ru/images/697/Blocked.jpg
No blocked elements in memory.

[Exits FF; cache gets cleared]

And here's when I disable that page with ABP disabled:
imagepost.ru/images/697/Allowed.jpg
As you can see, all the images are there. I did that before, that's why I inferred that ABP does block at least something.

Is that optical illusion?

Paul
vasa1
Posts: 76
Joined: Wed Apr 14, 2010 8:59 am

Re: Support for data:image

Post by vasa1 »

Paul, when you've loaded news.google.com, what do you see with View Page Source with and without using your method?
Post Reply